---
id: "CVE-2026-119075"
page: "https://infrastack.ai/live/CVE-2026-119075"
kind: "vulnerability"
aliases: ["CVE-2026-119075"]
title: "Registration Form for WooCommerce: unauthenticated checkout users can become Administrator"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "registration-form-for-woocommerce", "fixed": ["1.1.5"], "affected": "<= 1.1.4", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "registration-form-for-woocommerce", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-07T12:17:44+00:00"
first_seen_at: "2026-11-07T12:47:08+00:00"
updated_at: "2026-11-07T12:50:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119075", "first_seen_at": "2026-11-07T12:47:08+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/registration-form-for-woocommerce/registration-form-for-woocommerce-114-unauthenticated-privilege-escalation-to-user-roles-parameter-at-checkout", "first_seen_at": "2026-11-07T12:50:01+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/registration-form-for-woocommerce/registration-form-for-woocommerce-114-unauthenticated-privilege-escalation-to-user-roles-parameter-at-checkout", "https://wordpress.org/plugins/registration-form-for-woocommerce/"]}]
exploit_sources: []
---

# Registration Form for WooCommerce: unauthenticated checkout users can become Administrator

Link for people: https://infrastack.ai/live/CVE-2026-119075 (this .md is for agents)

The Registration Form for WooCommerce WordPress plugin, up to and including version 1.1.4, accepts a user_roles value at checkout without checking it against the allowed roles. An unauthenticated visitor can create an account with the administrator role and take over the whole site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:registration-form-for-woocommerce affected <= 1.1.4 fixed 1.1.5

## How to check

In WordPress admin > Plugins, check the Registration Form for WooCommerce version; 1.1.4 and earlier are affected, 1.1.5 is fixed. WP-CLI: wp plugin get registration-form-for-woocommerce --field=version. Also look for new unexpected Administrator users (wp user list --role=administrator).

## Fix

Update the Registration Form for WooCommerce plugin to 1.1.5 (WordPress admin > Plugins, or wp plugin update registration-form-for-woocommerce).

## Timeline

- 2026-11-07T12:47:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119075
- 2026-11-07T12:50:01+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/registration-form-for-woocommerce/registration-form-for-woocommerce-114-unauthenticated-privilege-escalation-to-user-roles-parameter-at-checkout — Fixed in 1.1.5 (06-11-2026) per ThemeGrill's wordpress.org changelog: 'Prevented privilege escalation via the user role submitted at checkout.' Wordfence advisory confirms <=1.1.4, CVSS 9.8, researcher JB Sabit. No exploitation or PoC seen. Unverified whether checkout registration must be enabled; who_affected left as is.

## Documents

- [advisory] Wordfence: Registration Form for WooCommerce <= 1.1.4 privilege escalation https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/registration-form-for-woocommerce/registration-form-for-woocommerce-114-unauthenticated-privilege-escalation-to-user-roles-parameter-at-checkout
- [fix] Registration Form for WooCommerce – changelog 1.1.5 (ThemeGrill, wordpress.org) https://wordpress.org/plugins/registration-form-for-woocommerce/

## From the sources

The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST['user_roles'] value in $this->valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account's role. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by supplying a user_roles=administrator parameter when creating an account during checkout, resulting in full site takeover.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_